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REMARKS 

The Examiner has rejected Claims 1-20 under 35 U.S.C. 1 02(b) as being 
anticipated by Chen et al. (U.S. Patent No. 5,960, 1 70). Applicant respectfully 
disagrees with such rejection. 

In particular, the Examiner relies on Fig. 4C-4D; col. 1 1, line 51 - col. 13» 
line 23; and col. 19, line 39 - col. 20, line 6 of Chen to make a prior art showing of 
applicant's claimed ''identifying a process for accessing files and selecting virus 
detection actions based at least in part on the identified process..." (see all of the 
independent claims). 

Applicant has carefully reviewed the foregoing excerpts along with the 
remaining Chen reference. During the course of such careful review, applicant 
notes that there is simply no identification of an application program -related 
"process for accessing files and selecting virus detection actions based at least in 
part on the identified process ." In sharp contrast, Chen merely suggests selecting 
virus detection actions based on fife types. See Figure 4C from Chen below, for 
example. 
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Fig. 40 

Further, this assertion is further corroborated by Chen's specific examples 

below: 
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"if the scanning scope is indicated by the request for virus 
scanning, scan according to the request"; 

"if the scanning scopo if not indicated by the request, 
determine whether the client includes writable nedia"; 

"if client does not include writable media, then do not 
perform virus scan"; 

"if a related scan det:ected Virus X, then scan client for 
Virus X"; 

"if the client includes a hard disk, then scan according to 
the conditions specific to the hard disk"; 

"if .exe files are present, 'chen perform file virus signature 
scan**, 

"if .com files are present, ;:hen perform file virus signature 
scan", 

"if application data files are present, then scan for macro 
viruses " , 

"if the client is a postal node, then scan all unread messages 
for attachments", 

"if the client, has received electronic mail, scan uuencoded 
portions thereof", and 

"if client Includes a Java applet execution engine, then scan 
for hostile Java appl<its'*; 

"If the client includ<:iS other writable media, the determine 
the conditions specific to the writable media and scan the 
writable media." (col. 23, lines 1-25) 

Only applicant teaches and claims the specific selection of virus detection 
actions based on an application program process for accessing files, in order provide 
tailored virus detection actions based on an application program (hat is accessing a 
file. 



Still yet, it is further noted that the foregoing excerpts and the remaining 
Chen reference fail to meet applicant's claimed "identifying a process for accessing 
files and selecting virus detection actions based at least in part on the identified 
process if no identifier is assigned thereto. " " assigning an identifier to the process if 
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no identifier is assigned thereto " and "selecting virus detection actions based at least 
in part on the identifier if existent 'Yemphasis added - see all independent claims). 

There is simply no identification of an application program process for 
accessing files on the condition that no identifier is assigned thereto , and assigning 
an identifier to the process if no identifier is assigned thereto, wherein virus 
detection actions are selected based at least in part on the identifier if existent . 

As set forth on page 4 of the originally filed specification, use of the 
application program process-specific identifier allows virus detection actions to be 
selected based on the identifier for accelerating the selection process. Thus, the 
present claimed invention need not identify the application program process, since 
the identifier (when available) is used to select the virus detection actions. By 
employing the identifier, the technique of selecting the virus detection actions based 
on the identification and analysis of the process may be avoided. Further, if the 
application program process-specific identifier is nonexistent, the claimed invention 
provides that an identifier is assigned thereto so that the technique of selecting the 
virus detection actions based on tJie identification and analysis of the process may be 
avoided the next time the application program process attempts to access a file. 

Still yet, the Examiner relies on coL 4, lines 15-30; col. 12, lines 12-35; and 
col. 1 3, lines 1-23 of Chen to make a prior art showing of applicant's claimed 
"process is associated with an application program, and different identifiers are 
assigned to different application programs so that the virus detection actions are 
tailored for the processes associated with the application programs." 

Again, Chen does not disclose, teach or even suggest any sort of application 
program process-specific identifiers, but rather merely "virus identifiers.** See. for 
example. Fig. 4C of Chen and the accompanying description. 

The Examiner is reminded that a claim is anticipated only if each and every 
element as set forth in the claim is found, either expressly or inherently described in 
a single prior art reference. Verdegaal Bros. v. Union Oil Co. Of California, 814 
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F.2d 628, 631, 2 USPQ2d 1051, 1053 (Fed. Cir, 1987). Moreover, the identical 
invention must be shown in as complete detail as contained in the claim. 
Richardson v. Suzuki Motor Ca.868 F.2d 1226, 1236, 9USPQ2d 1913, 1920 (Fed. 
Cir. 1989). The elements must be arranged as required by the claim. 

This criterion has simply not been met by the Chen reference, in view of the 
stark deficiencies noted above. A notice of allowance or a specific prior art showing 
of such claimed features, in combination with the remaining claim elements, is 
respectfully requested. 

It is further noted that the Examiner's application of Chen to applicant's 
dependent claims is further replete with deficiencies. For example, the Examiner 
relies on the following excerpt from Chen to make a prior art showing of the subject 
matter of Claims 2-6 et al, 

"Various types of scanning are implemented for efficient 
iterative analysis. An preferred technique which allov/s 
exhaustive signature scanning without requiring a 
comprehensive download of the signature data is described v/ith 



reference to FIG. 4D above. Other scanning techniques are also 
provided for iterative virus detection. For example, 
techniques for the determination of whether a macro includes a 
virus can be modularized or divided into a plurality of 
functions which can be performed by separate virus detection 
objects. To explain, in the detection of known and unknown 
viruses in macros, combinations of suspect instructions can be 
used in the determination of whether a file includes a virus. 
Specifically, a macro thaz includes both a first suspect 
instruction and a second suspecr instruction can be determined 
to include an unlcnown (or known) virus. Thus, in accordance 
with the present invention, separate virus detection objects 
are provided to first detect whether and which of several 
targeted files include a first suspect instruction, and then 
to determine whether those targeted files that include the 
first suspect instruction also include the second suspect 
instruction to detect, a virus. To produce a first virus 
detection object the IVDM 450a operates with the scanning 
module 454 and the virus rules module 458 to obtain the 
routines and data required for the detection of the first 
suspect instruction. After transmission of the first virus 
detection object fron*. the virus detection server 400 to the 
client 300 and execution by the client 300, identification of 
those files that incJude the first suspect instruction can be 
identified in the results transmitted to the virus detection 
server 400. Alternatively, the file identifiers can remain at 
the client 300 and the result could indicate which suspect 
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instruction was identified. Ir. either case, the virus 
detection server 400 can use the results to produce an 
additional virus detection object to determine whether the 
second suspect instruction is present." (see coi. 19, line 39 
- col. 20, line 6) 

With respect to Claim 2 et al., the foregoing Chen excerpt fails to disclose, 
teach, or even suggest any sort of 'identifier [that] is cleared upon the occurrence of 
a predetermined event " (emphasis added), let alone such functionality applied to an 
application program-process s pecific Identifier , as claimed. 

With respect to Claim 3 et al., the foregoing Chen excerpt fails to disclose, 
teach, or even suggest any sort of "identifier [that] is reused after being cleared" 
(emphasis added), let alone such functionality applied to an application program- 
process specific identifier , as claimed. 

With respect to Claim 4 el al., the foregoing Chen excerpt fails to disclose, 
teach, or even suggest any sort of clearance of the application program-process 
specific identifier specifically at * the termination of an application ." 

With respect to Claim 5 et al., the foregoing Chen excerpt fails to disclose, 
teach, or even suggest the specific assignment of the "identifier bv the application" 
(emphasis added), let alone such functionality applied to an application program- 
process specific identifier , as claimed. 

The Examiner continues to by relying on col 12, lines 12-35; and col. 13, 
lines I -23 from Chen to make a prior art showing of applicant's claimed "virus 
detection actions [that] are selected by determining a category associated with the 
process based on the identifier, aJid selecting a set of virus detection actions based 
on the determined category" (see Claim 19). Again, Chen fails to even suggest any 
sort of virus detection action selected based on application program-specific 
identifiers, let alone " determining a category associated with the process based on 
the [application program-specific] identifier , and selecting a set of virus detection 
actions based on the determined category ." 
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Again, a notice of allowance or a specific prior art showing of such claimed 
features, in combination with the remaining claim elements, is respectfully 
requested. 

In the event a telephone conversation would expedite the prosecution of this 
application, the Examiner may reach the undersigned at (408) 505-5100. If any fees 
are due in connection with the filing of this paper, the Commissioner is authorized to 
charge such fees to Deposit Account No. 50-1351 (Order No. NAll P003/00.069.01). 




Registration No. 41,429 

P.O. Box 721120 * / 

San Jose, C A 95172 / 
Telephone: (408)505-5100 
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